How to Import and Export PCAP Files for Network Analysis in Sniffnet

You can import PCAP files by selecting the "Capture file" source to create an offline CaptureContext reading from disk, and export live traffic by enabling the export toggle and providing a path before initiating the capture, with both workflows available via the GUI or CLI.

Sniffnet provides built-in support for reading existing packet captures and recording live traffic to disk using the standard PCAP format. This functionality leverages the underlying pcap library to handle both offline analysis of historical data and persistent storage of real-time network monitoring. Understanding how to import and export PCAP files for network analysis in Sniffnet allows you to integrate the tool into forensic workflows and share capture data across different analysis platforms.

Importing PCAP Files into Sniffnet

Importing allows you to analyze previously recorded network traffic as if it were a live device. The process involves switching the capture source from a network interface to a file path and initializing an offline capture context.

Configuring the Import Source

To begin importing, you must change the capture source to file mode. In the UI, this is handled by selecting "Capture file" from the source dropdown, which triggers Message::SetPcapImport. Programmatically, the path is stored in the global configuration struct.

In src/gui/sniffer.rs, the set_pcap_import method updates the configuration and capture source:

// UI message handling (src/gui/sniffer.rs)
Message::SetPcapImport(path) => self.set_pcap_import(path),

fn set_pcap_import(&mut self, path: String) {
    self.conf.import_pcap_path = path; // stored in Conf (src/gui/types/conf.rs)
    self.capture_source = CaptureSource::from_conf(&self.conf); // becomes File source
}

This updates Conf.import_pcap_path in src/gui/types/conf.rs and creates a CaptureSource::File variant using MyPcapImport::new(import_path).

Initializing the Offline Capture Context

Once the import path is configured, Sniffnet constructs a CaptureContext specifically for offline processing. In src/networking/types/capture_context.rs, the CaptureContext::new function receives the file source and builds a pcap::Capture<pcap::Offline>:

let capture_context = CaptureContext::new(
    &CaptureSource::File(my_pcap_import),
    None, // No export path for imports
    &conf.filters,
);

This CaptureContext is then used by the packet-parsing pipeline in parse_packets.rs and traffic_preview.rs, processing packets from disk exactly as it would from a live device.

Exporting Live Captures to PCAP Format

Exporting allows you to persist live network traffic to a file for later analysis. This requires enabling the export flag, configuring the output path, and attaching a savefile to the live capture context.

Enabling Export and Setting the Target Path

First, toggle the export mechanism and define the output location. The ExportPcap struct in src/gui/types/export_pcap.rs manages the enabled state, directory, and filename:

// Toggle the export switch (Message::ToggleExportPcap in src/gui/sniffer.rs)
self.conf.export_pcap.toggle();               // enable/disable export

// Set the output directory and filename (called after the user selects a folder)
self.conf.export_pcap.set_directory(path);
self.conf.export_pcap.set_file_name(name);

The full output path is computed by ExportPcap.full_path(), which returns Option<String>. If None, exporting is disabled; if Some(path), Sniffnet prepares to write to that location.

Attaching the Savefile to the Capture Context

When CaptureContext::new is called in src/networking/types/capture_context.rs, it checks for the export path. If full_path() returns Some(path), Sniffnet creates a pcap::Savefile using Capture::savefile and wraps the live capture in the CaptureContext::LiveWithSavefile variant:

let pcap_path = self.conf.export_pcap.full_path(); // Option<String>
let capture_context = CaptureContext::new(
    &self.capture_source,      // either Device or File source
    pcap_path.as_ref(),       // None → no export, Some(&String) → write to file
    &self.conf.filters,
);

Writing Packets in Real Time

With LiveWithSavefile active, every captured packet is automatically written to the Savefile by the underlying pcap library. This occurs within the CaptureContext::consume method, ensuring that your exported PCAP contains the exact traffic seen during the live capture session without requiring manual buffer management.

Using the Command-Line Interface

Both import and export workflows are fully exposed via CLI flags defined in src/cli/mod.rs, mapping directly to the configuration fields used by the GUI:

# Import a PCAP file for offline analysis

sniffnet --capture-source file --import-pcap-path my_capture.pcap

# Export captured traffic to a PCAP file during live monitoring

sniffnet --export-pcap --export-pcap-dir /tmp --export-pcap-name capture.pcap

These arguments populate the same Conf fields (import_pcap_path and export_pcap), ensuring identical runtime behavior whether you use the terminal or the graphical interface.

Summary

• Import workflow: Set Conf.import_pcap_path via the UI or --import-pcap-path, which creates a CaptureSource::File and initializes a pcap::Capture<pcap::Offline> in CaptureContext::new.
• Export workflow: Enable ExportPcap.enabled, set the directory and filename using methods in src/gui/types/export_pcap.rs, then pass the result of full_path() to CaptureContext::new to create a pcap::Savefile attached to the live capture.
• Key files: Configuration lives in src/gui/types/conf.rs, export logic in src/gui/types/export_pcap.rs, capture context management in src/networking/types/capture_context.rs, and CLI parsing in src/cli/mod.rs.
• Persistence: All paths and toggle states are stored in the Conf struct and persisted between sessions using confy.

Frequently Asked Questions

Can I export traffic when importing from an existing PCAP file?

No. Sniffnet only supports exporting when performing a live capture from a network device. The CaptureContext::LiveWithSavefile variant is only created for live sources, not for the CaptureSource::File used during import.

What file formats does Sniffnet support for import?

Sniffnet supports standard PCAP and PCAPNG files through the underlying pcap library's offline capture functionality, which handles the file format specifics when creating pcap::Capture<pcap::Offline> in CaptureContext::new.

Where does Sniffnet store the export configuration between sessions?

Export settings, including the enabled flag, directory path, and filename, are stored in the ExportPcap struct within Conf. This configuration is persisted to disk via confy in src/gui/types/conf.rs, so your export preferences survive application restarts.

Is there a performance penalty when exporting live captures?

The performance impact is minimal because the pcap::Savefile write operation is handled internally by the native pcap library during the standard packet consumption loop. The LiveWithSavefile branch in CaptureContext::consume writes packets directly without additional buffering in Rust, ensuring efficient I/O.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}